Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5svg-sanitizer is a PHP SVG/XML sanitizer.Check if you run itEPSS 0.42%Oct 14, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored…Check if you run itEPSS 0.18%Oct 14, 2026
- High7.5The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via…Check if you run itEPSS 0.69%Oct 14, 2026
- Medium4.9The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parame…Check if you run itEPSS 0.24%Oct 14, 2026
- High8.1The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the ' _type (e.g.Check if you run itEPSS 1.01%Oct 14, 2026
- High7.2The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input .Check if you run itEPSS 0.64%Oct 14, 2026
- High8.1The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_…Check if you run itEPSS 1.01%Oct 14, 2026
- High7.2The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles a…Check if you run itEPSS 0.41%Oct 14, 2026
- High7.2The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.…Check if you run itEPSS 0.31%Oct 14, 2026
- Critical9.8The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter.Check if you run itEPSS 1.03%Oct 14, 2026
- High8.6Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulati…Check if you run itEPSS 0.30%Oct 13, 2026
- High8.6Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCateg…Check if you run itEPSS 0.30%Oct 13, 2026
- Critical9.1Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated…Check if you run itEPSS 0.36%Oct 13, 2026
- Critical9.2Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 1.23%Oct 13, 2026
- Critical9.8The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function.Check if you run itEPSS 0.98%Oct 13, 2026
- Critical9.3Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file duCheck if you run itEPSS 0.66%Oct 13, 2026
- Critical9.8The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all ve…Check if you run itEPSS 0.85%Oct 13, 2026
- High8.1The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the cl…Check if you run itEPSS 0.85%Oct 13, 2026
- Medium5.5A vulnerability has been found in SourceCodester Online Reviewer System 1.0.Check if you run itEPSS 0.41%Oct 13, 2026
- Medium6.9A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3.Check if you run itEPSS 0.38%Oct 13, 2026
- Medium5.5A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0.Check if you run itEPSS 0.47%Oct 13, 2026
- Medium5.5A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.Check if you run itEPSS 0.51%Oct 13, 2026
- High8.8Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC MethodsCheck if you run itEPSS 0.33%Oct 13, 2026
- Medium5.5A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.Check if you run itEPSS 0.26%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attribute…Check if you run itEPSS 0.30%Oct 13, 2026